CCSP Practice Test 27 — 15 Questions

Question 1

A company runs a multi-tier cloud application with a web frontend, an API layer, and a database. The application uses OAuth 2.0 for authentication. Recently, users have been experiencing session hijacking attacks. Upon investigation, the security team finds that session tokens are being intercepted in transit. The application uses HTTPS for all communications, but a developer discovers that the application is also accessible via HTTP due to a misconfiguration. The team wants to implement additional security controls to prevent token theft. Which course of action should be taken first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement HTTP Strict Transport Security (HSTS) to enforce HTTPS connections. The root cause is that the application is accessible via HTTP due to a misconfiguration, allowing session tokens to be intercepted in transit despite HTTPS being available. Implementing HTTP Strict Transport Security (HSTS) forces the browser to always use HTTPS, preventing any HTTP connections and thus eliminating the interception vector. This directly addresses the misconfiguration before other controls, which would only mitigate but not prevent the theft.

Answer

Use IP address binding for session tokens

Answer

Switch from OAuth to SAML for authentication

Answer

Shorten the session token expiration time

Question 2

Refer to the exhibit. A security auditor is reviewing the security group configuration for a web server. Which change would improve the security posture without breaking the application functionality?

Accepted Answer

Remove Rule 1 because SSH should not be open to the internet.. SSH (port 22) should never be open to the internet (0.0.0.0/0) on a web server. Removing Rule 1 eliminates this unnecessary exposure while the web server's HTTP/HTTPS rules remain intact, preserving application functionality. This aligns with the principle of least privilege and reduces the attack surface.

Answer

Remove Rule 2 because HTTPS should be restricted to a specific IP range.

Answer

Remove Rule 4 because outbound traffic should be restricted.

Answer

Remove Rule 3 because RDP should be allowed from anywhere.

Question 3

An organization is migrating critical workloads to the cloud and must ensure data confidentiality. Which THREE of the following practices help protect data in transit? (Choose three.)

Accepted Answer

Implementing IPsec VPNs. Option A (Implementing IPsec VPNs) is correct because IPsec operates at the network layer to encrypt and authenticate IP packets between endpoints, protecting data as it travels across untrusted networks such as the internet. Option B (Using HTTPS for web applications) is correct because HTTPS wraps HTTP in TLS, encrypting the session between browser and server and preventing eavesdropping or tampering in transit. Option E (Using SSL/TLS for application traffic) is correct because TLS (and its predecessor SSL) provides cryptographic confidentiality and integrity for application-layer protocols, directly securing data in transit. Option C (Applying access control policies) is not a transit-encryption mechanism; it governs who may access resources and does not itself protect data confidentiality while it moves across a network. Option D (Enabling encryption for stored data) addresses data at rest, not data in transit, so it does not satisfy the scenario's requirement.

Answer

Applying access control policies

Answer

Enabling encryption for stored data

Question 4

A company uses a private artifact registry for internal packages. An attacker publishes a malicious package with the same name as an internal package to a public registry. Which attack is being described?

Accepted Answer

Dependency confusion attack. This is a dependency confusion attack, where an attacker uploads a malicious package to a public registry (e.g., npm, PyPI, Maven Central) using the same name as a private package used internally by the target organization. When a build system or developer's package manager is configured to check public registries first (or as a fallback), it may download the attacker's malicious version instead of the legitimate internal package, leading to code execution or data exfiltration.

Answer

Supply chain poisoning

Answer

Typosquatting

Answer

Man-in-the-middle attack

Question 5

Which THREE of the following are valid techniques to protect application programming interfaces (APIs) from abuse?

Accepted Answer

Use API gateways to enforce authentication and authorization policies.. Option A is correct because an API gateway acts as a centralized enforcement point where authentication (e.g., validating OAuth 2.0 tokens or mTLS client certificates) and authorization policies (e.g., scope or role checks) are applied before requests reach backend services, blocking unauthenticated or unauthorized abuse. Option D is correct because rate limiting and throttling cap the number of requests a client can make per time window (e.g., 100 requests/minute per API key), mitigating brute-force, credential-stuffing, scraping, and denial-of-service abuse. Option E is correct because requiring an API key or OAuth token on every request ensures each call is tied to an identifiable, revocable principal, enabling per-client quotas, auditing, and immediate revocation of compromised credentials. Option B is not a valid protection technique because an unencrypted JWT is only base64url-encoded and signed, not confidential—its payload can be read by anyone, so it does not protect the API from abuse and may leak sensitive claims. Option C is incorrect because restricting APIs to HTTP GET does not prevent abuse; GET requests can still be replayed, scraped, or flooded, and many legitimate operations require POST, PUT, or DELETE, so this neither authenticates nor limits callers.

Answer

Use JSON Web Tokens (JWT) without encryption.

Answer

Use only HTTP GET requests for all API calls.

Question 6

Refer to the exhibit. A cloud administrator ran the Azure CLI command to list virtual machines. One VM shows a ProvisioningState of 'Failed'. What is the most likely cause of this state?

Accepted Answer

The VM failed to start due to a resource quota limit or configuration error.. A 'ProvisioningState' of 'Failed' in Azure indicates that the VM could not be created or started due to a resource quota limit (e.g., vCPU quota exceeded) or a configuration error (e.g., invalid network interface, unsupported VM size). This state is set by the Azure Resource Manager when the deployment or update operation fails, and it persists until the underlying issue is resolved and the VM is redeployed or reconfigured.

Answer

The VM's resource group has been moved to another subscription.

Answer

The VM is in a deallocated state.

Answer

The VM was deleted by another administrator.

Question 7

A cloud security architect is concerned about potential side-channel attacks against VMs running on a shared hypervisor. Which TWO of the following measures would be most effective in mitigating such attacks?

Accepted Answer

Use dedicated (single-tenant) hosts for sensitive workloads.. Using dedicated (single-tenant) hosts ensures that the physical server is not shared with any other customer's VMs. This eliminates the possibility of a co-resident attacker exploiting shared hardware resources (such as CPU caches, memory buses, or branch predictors) to launch side-channel attacks like Prime+Probe or Flush+Reload. By removing the shared hypervisor layer between tenants, the attack surface for cross-VM side channels is effectively nullified.

Answer

Encrypt all data at rest using AES-256.

Answer

Implement network segmentation using VLANs.

Answer

Enable multi-factor authentication for all cloud administrative accounts.

Question 8

Which TWO of the following are best practices for securing a cloud-based container orchestration platform?

Accepted Answer

Use minimal base images to reduce the attack surface.. Using minimal base images (e.g., Alpine or distroless images) reduces the number of installed packages and libraries, thereby shrinking the attack surface. This practice limits the potential vectors for privilege escalation or remote code execution within containers, which is a core security principle for containerized workloads in platforms like Kubernetes.

Answer

Store secrets in environment variables for ease of use.

Answer

Run containers with root privileges by default.

Answer

Disable TLS certificate validation for internal communications.

Question 9

A company uses Azure Policy with remediation tasks to automatically fix non-compliant resources. Which scenario can be automatically remediated using a built-in policy?

Accepted Answer

A virtual machine missing the Log Analytics agent. The built-in Azure Policy 'Deploy Log Analytics agent to Windows VMs' includes a remediation task that automatically installs the Log Analytics agent on existing VMs that are missing it. This is a DeployIfNotExists policy effect, which triggers a remediation task to correct non-compliance without manual intervention.

Answer

A user creating a new Azure subscription

Answer

A SQL database with advanced data security disabled

Answer

A storage account with public network access enabled

Question 10

Which cloud-specific attack involves an application making HTTP requests to internal metadata endpoints such as 169.254.169.254 to retrieve cloud instance credentials?

Accepted Answer

Server-Side Request Forgery (SSRF). The attack described is Server-Side Request Forgery (SSRF), where an attacker exploits a vulnerable application to make HTTP requests to internal metadata endpoints like 169.254.169.254 (the link-local address for cloud instance metadata services). This allows the attacker to retrieve cloud instance credentials (e.g., AWS IAM role temporary credentials) that are normally accessible only from within the instance, leading to privilege escalation and lateral movement.

Answer

Dependency Confusion

Answer

Cross-Site Scripting (XSS)

Answer

SQL Injection

Question 11

A company is deploying a new application that processes sensitive personal data. The cloud provider operates in a specific region that adheres to the EU General Data Protection Regulation (GDPR). The company requires that data never leave the region. Which combination of cloud architecture controls should be implemented?

Accepted Answer

Use data sovereignty policies, restrict geographic deployment to the region, and disable cross-region replication.. Data sovereignty policies explicitly enforce that data remains within a specific jurisdiction, restricting geographic deployment to the region ensures all cloud resources are provisioned only in that region, and disabling cross-region replication prevents any automated or manual data transfer to other regions. This combination directly addresses the GDPR requirement that data never leave the designated region, as it controls both resource placement and data movement at the infrastructure level.

Answer

Use a virtual private cloud (VPC) with a route table that only allows egress to the internet through a NAT gateway.

Answer

Use encryption at rest and in transit with keys stored in a cloud HSM.

Answer

Use a cloud provider's CDN service to cache content within the region.

Question 12

A DevOps team is implementing a CI/CD pipeline for a cloud application. They want to automatically scan source code for security vulnerabilities before building the application. Which type of scanning should they integrate?

Accepted Answer

Static Application Security Testing (SAST). Static Application Security Testing (SAST) analyzes source code, bytecode, or binaries without executing the application, making it ideal for scanning code in a CI/CD pipeline before the build stage. It detects vulnerabilities such as SQL injection, XSS, and hardcoded secrets by inspecting code patterns and data flows. Integrating SAST early shifts security left, catching flaws before they reach runtime.

Answer

Interactive Application Security Testing (IAST)

Answer

Dynamic Application Security Testing (DAST)

Answer

Runtime Application Self-Protection (RASP)

Question 13

A company is adopting a serverless architecture using AWS Lambda. The security team is concerned about potential injection attacks via event payloads. Which practice is most effective at mitigating such attacks?

Accepted Answer

Validate and sanitize all input data from event sources. Serverless functions like AWS Lambda are directly invoked by event payloads, and without input validation and sanitization, an attacker can inject malicious code (e.g., SQL, NoSQL, OS commands) that the function executes. This is the most effective mitigation as it addresses the root cause at the application layer, regardless of any perimeter controls.

Answer

Use a web application firewall (WAF) in front of the API Gateway

Answer

Assign the least privilege IAM role to each Lambda function

Answer

Encrypt environment variables containing sensitive configuration

Question 14

A cloud security engineer is troubleshooting a failure in automated backups for a production database. The backup job runs nightly but has failed for the past three nights. The logs show permission denied errors when the backup service attempts to write to the storage bucket. Which action should the engineer take first?

Accepted Answer

Check the IAM roles and bucket ACLs assigned to the service account.. The permission denied errors indicate that the service account used by the backup job lacks the necessary permissions to write to the storage bucket. Checking the IAM roles and bucket ACLs is the first logical step to identify and resolve the misconfiguration, as it directly addresses the root cause without introducing unnecessary changes or escalations.

Answer

Open a support ticket with the cloud provider for incident response.

Answer

Restart the backup service and retry the job.

Answer

Rotate the service account keys used for authentication.

Question 15

A cloud-native application is deployed on AWS. During a security review, the team discovers that if an attacker can send a crafted request to the application, the application will make an HTTP request to http://169.254.169.254/latest/meta-data/iam/security-credentials/. Which vulnerability is being exploited?

Accepted Answer

Server-Side Request Forgery (SSRF). The vulnerability is Server-Side Request Forgery (SSRF). The attacker crafts a request that causes the application to make an HTTP request to the EC2 instance metadata service at 169.254.169.254, potentially retrieving IAM credentials. This is a classic SSRF attack targeting cloud metadata endpoints.

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Answer

Insecure deserialization